Klaviyo goes further than other platforms on delegation: its branded sending domain can have you delegate an entire subdomain through NS records. In exchange, you write neither SPF nor DKIM — Klaviyo publishes them itself inside the delegated zone.
Two routing modes
- Dynamic, via NS records: you delegate a subdomain to Klaviyo, which manages everything inside it. This is the recommended mode.
- Static, via CNAME: up to three records, plus a TXT record for ownership verification.
In static mode the DKIM selectors differ by domain type: km1 and km2 for marketing, kt1 and kt2 for transactional, ks1 and ks2 for service. Copying one type’s selectors onto another is a classic cause of failure.
What delegation implies
SPF and DKIM are published automatically inside the delegated subdomain, which becomes the envelope address. Relaxed alignment ties it to your parent domain: DMARC compliance is achieved without touching your root SPF record.
There is a real trade-off: on a subdomain delegated by NS, you no longer control the zone. Any record you want to put there has to go through Klaviyo.
DMARC
Publish the monitoring policy on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:your-address@yourdomain.comOnly tighten once every sender is identified. The progression, step by step.
Common mistakes with Klaviyo
- A DNS host that refuses NS delegation of a subdomain. Not all allow it; you then have to switch to static mode.
- Adding a Klaviyo
includeto your root SPF. Pointless, and one fewer DNS lookup out of ten. - Mixing marketing and transactional selectors when both domains coexist.
- Sending from the root domain when only the branded subdomain is configured.
Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.